How to install CouchDB with Let’s Encrypt on Ubuntu 20.04 LTS

CouchDB is a NoSQL database like MongoDB. Couch stands for cluster of unreliable commodity hardware (a storage system for a large-scale object database). CouchDB uses JSON to store data, JavaScript to run queries and HTTP as an API. One of the advantages of CouchDB is its ability to replicate to other devices and work offline, then synchronise again later. In this article, we will show you how to install CouchDB with Let’s Encrypt on Ubuntu 20.04.

Install CouchDB

To install CouchDB, run these commands:

# apt update && sudo apt install -y curl apt-transport-https gnupg
# curl https://couchdb.apache.org/repo/keys.asc | gpg --dearmor | tee /usr/share/keyrings/couchdb-archive-keyring.gpg >/dev/null 2>&1
# source /etc/os-release
# echo "deb [signed-by=/usr/share/keyrings/couchdb-archive-keyring.gpg] https://apache.jfrog.io/artifactory/couchdb-deb/ ${VERSION_CODENAME} main" \
| sudo tee /etc/apt/sources.list.d/couchdb.list >/dev/null

Next, we will install it. We will also be prompted to create the user and check which IP address we can access it from.

# apt update
# apt install -y couchdb

When installing couchdb, you must choose the first option.

Then we need to enter 0.0.0.0 so that we can access the server from any location.

With this command, we can check that CouchDB is running on port 5984. Remember to open TCP ports 5984 and 6984 in the firewall in the client panel; we will need them later.

# curl localhost:5984

Once connected to the CouchDB server, we can open http://IP_servidor:5984/_utils/index.html in our browser. There, we can create a username and password; we will use the ones we created during installation.

Install Let’s Encrypt

Install certbot and lighttpd:

# apt-get install certbot lighttpd

Create a directory for SSL and generate the SSL certificate with our domain:

# mkdir /etc/couchdb/letsencrypt
# certbot certonly --webroot -w /var/www/html --config-dir /etc/couchdb/letsencrypt --logs-dir /var/log/couchdb -d midominio.com
# mkdir /var/lib/couchdb/cert/
# cp /etc/couchdb/letsencrypt/live/midominio.com/privkey.pem /var/lib/couchdb/cert/
# cp /etc/couchdb/letsencrypt/live/midominio.com/cert.pem /var/lib/couchdb/cert/
# chown couchdb.couchdb /var/lib/couchdb/cert* -R

CouchDB + SSL

Now we will edit the local CouchDB configuration to make it work over SSL

# nano /opt/couchdb/etc/local.ini

We will modify the following lines:

[ssl]
enable = true
cert_file = /var/lib/couchdb/cert/cert.pem
key_file = /var/lib/couchdb/cert/privkey.pem

Now we will edit the default CouchDB configuration:

# nano /opt/couchdb/etc/default.ini

We will modify the following lines:

[ssl]
port = 6984

Restart CouchDB:

# systemctl restart couchdb.service

We can now access CouchDB with SSL at https://midominio.com:6984/.

Renew SSL automatically

We will create a file /root/letsencrypt-renewal.sh with the following content:

/usr/bin/certbot renew --quiet --renew-hook "/bin/cp -apr /etc/letsencrypt/archive/midominio.com/fullchain.pem /var/lib/couchdb/cert/ && /bin/cp -apr /etc/letsencrypt/archive/midominio.com/privkey.pem /var/lib/couchdb/cert/ && /usr/sbin/service couchdb stop && /usr/sbin/service couchdb start"

We will add it to crontab so that it runs 1 time a week.

# crontab -e

1 0 * * 1 /root/letsencrypt-renewal.sh